CN116308372A

CN116308372A - Detection method and device for blockchain transaction

Info

Publication number: CN116308372A
Application number: CN202211522132.1A
Authority: CN
Inventors: 周健飞; 邬萌; 王海军
Original assignee: Ant Blockchain Technology Shanghai Co Ltd
Current assignee: Ant Blockchain Technology Shanghai Co Ltd
Priority date: 2022-11-30
Filing date: 2022-11-30
Publication date: 2023-06-23

Abstract

The embodiment of the specification provides a detection method and device for blockchain transactions. The method comprises the following steps: firstly, acquiring transaction data of a target transaction on a blockchain, wherein the business logic of a target intelligent contract called by the target transaction comprises the following steps: issuing the target class digital resources with the first quantity transferred from the contract account to the target account, and returning the target class digital resources with the second quantity transferred from the target account to the contract account; resolving a plurality of transfer events from the transaction data, wherein each transfer event comprises a transfer party, a digital resource type and the quantity of transfer occurring for the digital resource of the type; then, determining the resource variation of the target account for various digital resources according to a plurality of transfer events, and acquiring the resource value of various digital resources when the target transaction execution is completed; and determining the value change amount generated by the target transaction for the target account based on the resource change amount and the resource value, and judging the risk of the target transaction.

Description

Detection method and device for blockchain transaction

Technical Field

The embodiment of the specification belongs to the technical field of blockchain, and particularly relates to a detection method and device for blockchain transactions.

Background

Blockchain (Blockchain) is a new application mode of computer technologies such as distributed data storage, point-to-point transmission, consensus mechanisms, encryption algorithms, and the like. In the block chain system, the data blocks are combined into a chain data structure in a sequential connection mode according to the time sequence, and the distributed account book which is not tamperable and counterfeit and is ensured in a cryptographic mode is formed. Because the blockchain has the characteristics of decentralization, non-tamperability of information, autonomy and the like, the blockchain is also receiving more and more attention and application.

Disclosure of Invention

The invention aims to provide a detection method and a detection device for a blockchain transaction, which are used for efficiently identifying risk transactions in the blockchain transaction and providing early warning for related parties.

The first aspect of the present description provides a detection method for blockchain transactions. The method comprises the following steps: acquiring transaction data of a target transaction on a blockchain, wherein the target transaction invokes a target intelligent contract; the business logic of the target intelligent contract comprises: the first quantity of the target class digital resources transferred from the contract account are issued to the target account, and the second quantity of the target class digital resources transferred from the target account are returned to the contract account. Several transfer events are parsed from the transaction data, wherein each transfer event includes a transfer party, a digital asset type, and the number of transfers that occur for that type of digital asset. And determining the resource variation of the target account for various digital resources according to the plurality of transfer events. And acquiring the resource value of various digital resources when the target transaction execution is completed. And determining the value change amount generated by the target transaction for the target account based on the resource change amount and the resource value, and judging the risk of the target transaction.

A second aspect of the present description provides a detection apparatus for blockchain transactions. The device comprises: the transaction data acquisition module is configured to acquire transaction data of a target transaction on the blockchain, and the target transaction invokes a target intelligent contract; the business logic of the target intelligent contract comprises: the first amount of the target class digital resource transferred from the contract account is issued to the target account, and the second amount of the target class digital resource transferred from the target account is returned to the contract account. And the transfer event determining module is configured to parse out a plurality of transfer events from the transaction data, wherein each transfer event comprises a transfer party, a digital resource type and the quantity of transfer occurring for the digital resource of the type. The resource change determining module is configured to determine the resource change amount of the target account aiming at various digital resources according to the plurality of transfer events. The resource value determining module is configured to acquire the resource values of various digital resources when the target transaction execution is completed. The value change determining module is configured to determine a value change amount generated by the target transaction for the target account based on the resource change amount and the resource value, and is used for judging the risk of the target transaction.

A third aspect of the present description provides a computer-readable storage medium having stored thereon a computer program which, when executed in a computer, causes the computer to perform the method of the first aspect.

A fourth aspect of the present specification provides a computing device comprising a memory having executable code stored therein and a processor which when executing the executable code implements the method of the first aspect.

In the scheme provided by the embodiment of the specification, by adopting the detection method and the detection device for the blockchain transaction disclosed by the embodiment of the specification, the quantity change condition of the attacker address for various digital resources before and after the transaction can be counted, the transaction of calling the target intelligent contract on the blockchain can be automatically detected in real time by combining the real-time resource value determined for each digital resource, and whether the transaction has a arbitrage risk or not can be evaluated. Therefore, timely early warning of the arbitrage transaction can be realized, and the similar attack is prevented from happening again.

Drawings

In order to more clearly illustrate the technical solutions of the embodiments of the present disclosure, the drawings that are needed in the description of the embodiments will be briefly described below, and it is obvious that the drawings in the following description are only some embodiments described in the present disclosure, and that other drawings may be obtained according to these drawings without inventive effort for a person skilled in the art.

FIG. 1 is a block chain architecture diagram in one embodiment;

FIG. 2 is a flow chart of a detection method for blockchain transactions in the embodiment of the present disclosure;

fig. 3 is a schematic structural diagram of a detection device for blockchain transactions in the embodiment of the present disclosure.

Detailed Description

In order to make the technical solutions in the present specification better understood by those skilled in the art, the technical solutions in the embodiments of the present specification will be clearly and completely described below with reference to the drawings in the embodiments of the present specification, and it is obvious that the described embodiments are only some embodiments of the present specification, not all embodiments. All other embodiments, which can be made by one of ordinary skill in the art without undue burden from the present disclosure, are intended to be within the scope of the present disclosure.

The blockchain architecture, transactions, and intelligent contracts, etc., involved in blockchain technology are described below in basic terms with reference to fig. 1.

FIG. 1 illustrates a block chain architecture diagram in one embodiment. In the blockchain architecture diagram shown in fig. 1, the blockchain 100 includes N nodes, and nodes 1-8 are schematically shown in fig. 1. The connections between nodes schematically represent P2P (Peer to Peer) connections, which may be TCP connections or the like, for example, for transmitting data between nodes. The nodes may store a full amount of ledgers, i.e., the state of all blocks and all accounts. Wherein each node in the blockchain may generate the same state in the blockchain by performing the same transaction, each node in the blockchain may store the same state database.

Transactions in the blockchain domain may refer to task units that execute in the blockchain and are recorded in the blockchain. The transaction typically includes a send field (From), a receive field (To), and a Data field (Data). Where the transaction is a transfer transaction, the From field indicates an account address From which the transaction was initiated (i.e., a transfer task To another account was initiated), the To field indicates an account address From which the transaction was received (i.e., a transfer was received), and the Data field includes the transfer amount.

The functionality of the smart contract may be provided in the blockchain. Intelligent contracts on blockchains are contracts on blockchain systems that can be executed by transaction triggers. The smart contracts may be defined in the form of codes. Invoking the smart contract in the blockchain initiates a transaction directed to the smart contract address such that each node in the blockchain runs the smart contract code in a distributed manner.

In the scenario of deploying contracts, for example, bob sends a transaction containing information to create an intelligent contract (i.e., deploying a contract) into a blockchain as shown in fig. 1, the data field of the transaction includes the code (e.g., bytecode or machine code) of the contract to be created, and the to field of the transaction is empty to indicate that the transaction is for deploying the contract. After agreement is reached between the nodes through a consensus mechanism, a contract address of '0 x6f8ae93 …' of the contract is determined, each node adds a contract account corresponding to the contract address of the intelligent contract in a state database, allocates a state storage corresponding to the contract account, stores a contract code, and stores a hash value of the contract code in the state storage of the contract, so that the contract creation is successful.

In the scenario of invoking a contract, for example, bob sends a transaction for invoking a smart contract into the blockchain as shown in fig. 1, the from field of the transaction is the address of the account of the transaction initiator (i.e., bob), the to field is the aforementioned "0x6f8ae93 …", i.e., the address of the invoked smart contract, and the data field of the transaction includes the method and parameters for invoking the smart contract. After the transaction is consensus in the blockchain, each node in the blockchain may execute the transaction separately, thereby executing the contract separately, updating the status database based on execution of the contract.

Blockchain technology differs from one of the decentralized features of conventional technology in that accounting is performed on individual nodes, otherwise known as distributed accounting, rather than conventional centralized accounting. The blockchain system is to be a hard-to-break, public, untampered, decentralised, honest and trusted system for data records, and needs to be secure, clear and irreversible for distributed data records in as short a time as possible. In different types of blockchain networks, in order to keep account books consistent among the nodes of each record account book, a consensus algorithm is generally adopted to ensure that the above-mentioned consensus mechanism is adopted. For example, a block granularity consensus mechanism may be implemented between blockchain nodes, such as after a node (e.g., a unique node) generates a block, if the generated block is approved by other nodes, the other nodes record the same block. For another example, a transaction granularity consensus mechanism may be implemented between blockchain nodes, for example, after a node (e.g., a unique node) obtains a blockchain transaction, if the blockchain transaction is approved by other nodes, each node approving the blockchain transaction may respectively add the blockchain transaction to its own maintained latest block, and finally, each node may be ensured to generate the same latest block. The consensus mechanism is a mechanism that the blockchain node achieves the consensus of the whole network about the blockinformation (or blockdata), and can ensure that the latest block is accurately added to the blockchain. The consensus mechanisms of the current mainstream include: proof of Work (POW), proof of equity (POS), proof of commission (Delegated Proof of Stake, DPOS), practical bayer fault tolerance (Practical Byzantine Fault Tolerance, PBFT) algorithms, and the like. Among the various consensus algorithms, the success of consensus on a consensus proposal is determined, typically after a preset number of nodes agree on the data to be consensus (i.e., the consensus proposal). Specifically, in the PBFT algorithm, f malicious nodes can be tolerated for N.gtoreq.3f+1 consensus nodes, that is, when 2f+1 nodes in the N consensus nodes agree, success of the consensus can be determined.

In the above, some basic concepts in blockchain technology are mainly introduced.

As previously mentioned, blockchains have received increasing attention and application. For example, transactions such as publishing, transferring, lending, etc. of digital resources (e.g., electronic tickets, etc.) may be performed in the blockchain. In a lending business scenario, a service party provides a lending service of digital resources to a user by deploying intelligent contracts in a blockchain; the user can borrow a large amount of digital resources by using the lending service, provided that the lending and returning of the digital resources are ensured to be completed in one transaction. Some attackers use large digital resources borrowed from the lending service to buy, sell and the like on different digital resources in a short time so as to control exchange rates of the different digital resources, thereby taking high benefit. When an attacker finds that his attack is successful, a similar attack will typically be performed again. At present, for risk transactions with the aim of arbitrage, detection is mainly carried out by manual analysis, so that the workload is large, the cost is high and the real-time performance is poor.

Based on the above observations and analyses, the present embodiments disclose a detection scheme for blockchain transactions that can automatically and efficiently detect risk transactions for the purpose of arbitrage.

Fig. 2 is a flow chart of a detection method for blockchain transactions according to an embodiment of the present disclosure, where an execution subject of the method may be any apparatus, platform, server or device cluster with computing and processing capabilities. For example, the functional code for implementing the method may be deployed in other devices than a blockchain, or may be deployed in a blockchain node, e.g., on a blockchain full node.

As shown in fig. 2, the method comprises the steps of:

step S210, obtaining transaction data of a target transaction on the blockchain, wherein the target transaction invokes a target intelligent contract. The business logic of the target intelligent contract comprises: and issuing the first amount of the target class digital resources from the contract account of the target intelligent contract to the target account, and returning the second amount of the target class digital resources from the target account to the contract account.

It will be appreciated that the service party may provide lending services by deploying the target smart contracts in the blockchain. The target class digital resource refers to a class of digital resource aimed by the target intelligent contract, and is distinguished from other class digital resources circulated on the blockchain. The target account is a blockchain account, and can be an external account or a contract account.

The incoming parameters of the target smart contract include at least the target account and the first quantity. In one embodiment, the second number may be automatically calculated by the target smart contract based on the first number according to a preset Ben (principal+interest) calculation mode, and typically, the second number is larger than the first number. In another embodiment, the incoming parameters of the target smart contract further include the second number, and at this time, the business logic of the target smart contract may further include: and under the condition that the ratio of the second quantity to the first quantity is larger than the preset proportion threshold value, issuing the first quantity of the target class digital resources to the target account.

In one embodiment, the target transaction also invokes a number of smart contracts other than the target smart contract, e.g., invoking a smart contract for providing redemption services between heterogeneous digital resources. It is to be understood that several references herein refer to one or more.

In a specific embodiment, the plurality of smart contracts includes a first smart contract for two types of digital resources, the business logic of the first smart contract comprising: the first contract account of the first smart contract receives a third amount of the first type of digital resources transferred from the first account and transfers a fourth amount of the second type of digital resources from the first contract account to the first account. It is understood that the first account may be an external account or a smart contract account. In one example, deployment of the first smart contract is based on a second smart contract in which a tradable relationship between the two types of digital resources is established, whereby the two types of digital resources form a transaction resource pair.

The incoming parameters of the first smart contract may include the first account and a third quantity, and the fourth quantity may be obtained by the first smart contract converting the third quantity according to a real-time exchange rate between the two types of digital resources. In one example, the first account is entered into the same account address as the target account described above. In one example, the first type of digital resource is a target type of digital resource.

The above describes contract invocations that may be involved in a target transaction.

In the execution of this step, transaction data for a plurality of transactions may be first obtained from the blockchain network.

In one embodiment, the plurality of transactions includes transactions stored in a blockchain, i.e., packaged uplink transactions. In another embodiment, the plurality of transactions includes transactions broadcast in a blockchain network collected in real-time. It should be appreciated that, for a newly mined block, any blockchain node will broadcast it in the blockchain network after verifying that it is legal, based on which the broadcasted block can be monitored in real time, thereby acquiring transactions on the block. By way of example, newly-added transactions in the blockchain can be monitored in real time through the blockchain full node, so that risk transactions can be identified in time.

In one embodiment, the transaction data may include a transaction body for each transaction, and/or a transaction log. In a specific embodiment, the transaction data includes a transaction hash, a block number, addresses of a transaction initiator and a transaction recipient, input parameters (such as a data field) of the transaction, an execution result of the transaction, and internal transaction data of an internal transaction triggered by invoking an intelligent contract in the transaction, wherein the internal transaction data includes addresses of an internal transaction caller and the internal transaction recipient, and the input parameters (such as the data field) of the internal transaction.

Based on the transaction data of the plurality of transactions acquired above, a target transaction may be screened from the plurality of transactions.

In one embodiment, a plurality of transactions that have called a preset objective function may be directly screened from a plurality of transactions, and then the plurality of transactions are respectively used as objective transactions. Wherein the objective function is used to implement business logic of the objective smart contract. It should be appreciated that the target intelligent contract includes a plurality of functions from which one or a group of functions having a degree of differentiation and strongly associated with the lending service may be selected as the predetermined target function.

Specifically, the transaction data includes a method and parameters for calling the intelligent contract in the corresponding transaction, so that the transaction data of each transaction in the plurality of transactions can be respectively matched based on a preset objective function, and a plurality of successfully matched transactions can be obtained.

In another embodiment, the pre-screening may be performed on a plurality of transactions, and then the plurality of transactions may be determined according to the pre-screening result, so as to improve the execution efficiency of this step.

In a specific embodiment, the pre-screening may include: and filtering out the transactions with the transaction log length lower than a preset length threshold. For example, the length of the transaction log may be measured using the number of characters or the memory space occupied.

In another specific embodiment, the pre-screening may include: and filtering out the transactions of which the number of the related transfer events is smaller than a preset number threshold value. For the determination of the number of the transfer type events, in one example, the transaction data includes a transaction log, the transaction log records the parsed events, and event parameters such as event types are specifically recorded, and at this time, the number of the transfer type events in the transaction log can be respectively determined for each transaction; in another example, the transaction data includes transaction bodies, and at this time, the Virtual Machine (VM) deployed on the blockchain node may be used to execute the transaction bodies of each transaction, so as to determine the number of transfer events related to each transaction.

In yet another specific embodiment, the pre-screening may include: transactions with input parameters that are null are filtered out.

Through the pre-screening operation described above, transactions that are not likely to invoke the target smart contract may be excluded from the plurality of transactions. Further, the transactions calling the preset objective function may be screened out based on the retained transactions, so that each transaction in the transactions is taken as a target transaction.

Based on the target transaction obtained above, step S220 may be performed to parse out a number of transfer events from the transaction data of the target transaction, wherein each transfer event includes a transfer party, a type of digital resource, and a number of transfers occurring for the type of digital resource.

In one embodiment, all transfer type events may be parsed from transaction data of the target transaction (hereinafter or simply target transaction data) as the several transfer events. In a specific embodiment, the target transaction data includes a transaction log for recording blockchain events, so that all events with the types of transfer can be resolved from the transaction log and classified into the transfer events. In another specific embodiment, the target transaction data includes a transaction body, and at this time, the transaction body may be executed by using a VM deployed on the blockchain node, so that the foregoing transfer events are obtained by analyzing the execution result.

Each transfer event may be organized as a quad E<Type ID,From,To,T _delta >In which the Type ID represents an identification of the Type of digital resource, for example, an identification of an intelligent Contract that manages (e.g., issues) the Type of digital resource, typically a Contract Address (contact Address) of the intelligent Contract; from represents the sender of the transfer event, or the sender of the transfer; to represents the transfer party of the transfer event, or the transfer recipient; t (T) _delta Representing the number of transfers of the digital resource.

Further, in one example, the number of transfer events parsed in this step may include:

e1: < type 1, CA, TA,10000>

E2: < type 1, TA, BA,9000>

E3: < type 2, BA, TA,3000>

E4: < type 2, TA, BA,2500>

E5: < type 1, BA, TA,10000>

E6: < type 1, TA, CA,10050>

In the 7 transfer events E1 to E6 shown above, CA represents a contract account address of a target smart contract, TA represents an account address of a target account, and BA represents a contract account address of a smart contract providing digital resource exchange services for type 1 and type 2. Observing events E1 and E6, the TA borrows 10000 parts of the type 1 digital resource to the CA, and returns 10050 parts of the type 1 digital resource; observing events E2 and E3, the TA redeems 9000 parts of the type 1 digital resource for 3000 parts of the type 2 digital resource for the BA; observing events E4 and E5, the TA redeems 10000 parts of type 1 digital resource for BA with 2500 parts of type 2 digital resource.

In another embodiment, all the transfer events may be parsed from the target transaction data, and then the transfer events in which the transfer party or the transfer party is the target account may be classified as a plurality of transfer events.

From this, several transfer events related to the target transaction may be determined. Then, step S230 may be performed to determine a resource variation amount of the target account for various digital resources according to the plurality of transfer events.

The plurality of transfer events relate to a plurality of types of digital resources, and the resource variation of the target account for each type of digital resources in the plurality of types of digital resources can be obtained by carrying out statistical analysis on the plurality of transfer events. For example, by performing statistical analysis on the events E1 to E6, it may be determined that the amount of change of the target account TA for the type 1 and type 2 digital resources is: +950 and +500.

On the other hand, step S240 is executed to obtain the resource value of each type of digital resource when the execution of the target transaction is completed. In particular, the above-mentioned multiple types of digital resources can be respectively converted into predefined equivalents, thereby realizing a unified measure of value. It is to be understood that equivalents may generally be defined as any one measurable item. By way of example, an equivalent may be a certain type of digital resource that is preset.

In one embodiment, the multiple types of digital resources include a third type of digital resource with dynamically changing unit value, so that an exchange rate between the third type of digital resource and a fourth type of digital resource with a preset value can be determined first, and then the real-time value of the third type of digital resource after the target transaction is executed can be determined according to the exchange rate and the preset value.

For the above exchange rate determination, in a specific embodiment, after the target transaction is executed, the number of resources in the corresponding resource pool of each of the third type of digital resources and the fourth type of digital resources may be determined, and then the exchange rate between the third type of digital resources and the fourth type of digital resources may be determined based on the number of resources. In a more specific embodiment, the update event of the number of digital resources associated with both types of digital resources may be determined based on the target transaction data, as well as transaction data of other transactions occurring prior to the target transaction, to thereby determine the number of resources in the resource pool.

In another more specific embodiment, the mapping relationship between the plurality of well-known service parties and the plurality of intelligent contracts in the blockchain for managing the plurality of types of digital resources can be established through a query function of the blockchain browser. Therefore, the transaction interacted with the known service party is filtered out from a plurality of transactions stored in the blockchain, the data of the filtered transaction is analyzed, the event that the number of the digital resources is updated is analyzed, and then the number of the resources of the third type of digital resources and the fourth type of digital resources in the resource pool is determined.

Further, the determined two resource numbers may be substituted into a preset exchange rate calculation formula for the third and fourth type of digital resources to obtain an exchange rate therebetween.

Based on the obtained exchange rate, the number of the third type of digital resources in unit number converted into the fourth type of digital resources can be determined, and then the resource value of the third type of digital resources is determined according to the number and the preset value of the fourth type of digital resources.

In another embodiment, the multiple types of digital resources include a fourth type of digital resource having a preset unit value, where the preset unit value may be directly determined as the resource value of the fourth type of digital resource.

From the above, the resource variation of various digital resources and the resource value of various digital resources after the target transaction is executed can be determined. Then, step S250 is executed to determine the value variation generated by the target transaction for the target account based on the resource variation and the resource value, so as to determine the risk of the target transaction.

In one embodiment, for each type of resource involved in the target transaction, the product between the corresponding resource variation and the resource value may be calculated first, and then the sum of the calculated products may be calculated as the value variation.

Illustratively, assuming that the digital resources of type 1 and type 2 are involved in the target transaction, the resource variation and the resource value corresponding to type 1 are +950 and 1, respectively, and the resource variation and the resource value corresponding to type 2 are +500 and 2, respectively, at this point, the bid value variation may be calculated to be 1950.

In another embodiment, considering that some digital resources may already exist in the target account prior to executing the target transaction, for brevity, the digital resources will be referred to as initial digital resources hereinafter, and the initial digital resources may be obtained by querying or tracking transfer events related to the target account, for example. In this case, when calculating the value change amount, the value change of the initial digital resource caused by the execution of the target transaction may be considered, and specifically, a portion of the initial digital resource having the same type as the digital resource related to the target transaction may be considered.

In a specific embodiment, for each type in the type intersection formed by the same type, the initial value of the type before executing the target transaction is determined, and then the initial value is subtracted by using the resource value of the type when the execution of the target transaction is completed, so that the value change component brought by executing the target transaction for the digital resource part with the type in the initial digital resource is obtained by multiplying the obtained difference value by the number of the type in the initial digital resource. It should be understood that, the determination manner of the initial value may refer to the foregoing determination manner for the resource value, which is not described in detail.

Further, the value change components corresponding to the types in the type intersection are summed to obtain a first value change amount generated by the execution target transaction as the initial resource in the target account, and a second value change amount generated by the resource change amount brought to the target account by the execution target transaction is superimposed on the first value change amount, so that the value change amount (or the total value of the value change) brought to the target account by the execution target transaction can be obtained.

In another example, based on the initial digital resources and the resource variation amounts, the number of the target account which is successively possessed by each type of digital resources before and after the target transaction is executed can be determined, and then, the value variation amount brought by executing the target transaction as the target account is determined according to the values of each type of digital resources before and after the target transaction is executed.

From the above, the amount of change in value brought by the execution of the target transaction for the target account can be determined.

According to an embodiment of another aspect, consider the case where there is an attacker transferring the benefits in the target account to other accounts in order to avoid that the arbitrage transactions they initiate are monitored. In the step S230, when determining the resource variation, it may be determined that the target account and the initiating account initiating the target transaction together target the variation of various digital resources. Illustratively, in addition to determining the events E1-E6 described above, the following events E7-E8 are determined from the transaction data of the target transaction:

E7: < type 1, TA, FA,950>

E8: < type 2, TA, FA,500>

At this time, if only the resource variation amount of the target account is determined, the determined corresponding types 1 and 2 may be 0 and 0, but if the resource variation amounts for the target account and the initiator account FA are determined, the determined still are 950 and 500.

Accordingly, in step S250, the determined value change is for both the target account and the initiating account.

According to an embodiment of yet another aspect, after performing step S250, the above method may further include: and judging whether the value change is larger than a preset increment threshold value, so that the target transaction is judged to be a risk transaction under the condition that the value change is larger than the preset increment threshold value, and otherwise, judging to be a normal transaction. Further, under the condition that the target transaction is judged to be the risk transaction, the contract creator of the intelligent contract invoked in the target transaction can be warned to remind the contract creator of the intelligent contract to timely repair the vulnerability, so that the similar attack is prevented from happening again. Alternatively, after step S250 is performed, the value change amount may also be used as a risk score as a risk reference.

By the method, risk transactions with the aim of automatically identifying the arbitrage contained in the blockchain can be realized.

In summary, by adopting the detection method for blockchain transactions disclosed by the embodiment of the specification, the quantity change condition of attacker addresses for various digital resources before and after the transactions can be counted, the transactions of calling target intelligent contracts on the blockchain can be automatically detected in real time by combining the real-time resource value determined for each digital resource, and whether the transactions are favorable in risk or not can be evaluated. Therefore, timely early warning of the arbitrage transaction can be realized, and the similar attack is prevented from happening again.

Corresponding to the above detection method, the embodiments of the present specification also disclose a detection device. Fig. 3 is a schematic structural diagram of a detection device for blockchain transactions according to an embodiment of the present disclosure, and as shown in fig. 3, the device 300 includes the following constituent modules:

a transaction data acquisition module 310 configured to acquire transaction data for a target transaction on the blockchain, the target transaction invoking a target smart contract; the business logic of the target intelligent contract comprises: the first amount of the target class digital resource transferred from the contract account is issued to the target account, and the second amount of the target class digital resource transferred from the target account is returned to the contract account. The transfer event determination module 320 is configured to parse out a number of transfer events from the transaction data, wherein each transfer event includes a transfer party, a type of digital resource, and a number of transfers that occur for the type of digital resource. The resource change determining module 330 is configured to determine, according to the plurality of transfer events, a resource change amount of the target account for various digital resources. The resource value determination module 340 is configured to obtain the resource values of various types of digital resources when the target transaction execution is completed. The value change determination module 350 is configured to determine, based on the resource change and the resource value, a value change generated by the target transaction for the target account, for determining a risk of the target transaction.

In one embodiment, the transaction data includes at least one of: transaction body, transaction log, including a plurality of transfer events in the transaction log.

In one embodiment, the transaction data acquisition module 310 specifically includes: a data acquisition unit 311 configured to acquire transaction data of a plurality of transactions stored in a blockchain; a transaction screening unit 312 configured to screen out a plurality of transactions calling a preset objective function based on transaction data of a plurality of transactions; the objective function is used for realizing business logic; each of the plurality of transactions is respectively taken as a target transaction.

In a particular embodiment, the transaction screening unit 312 is specifically configured to: removing transactions for which the number of transfer events related to the transaction data is less than a preset number threshold from the plurality of transactions; and screening a plurality of transactions from the remaining transactions based on transaction data of the remaining transactions.

In one embodiment, the target transaction also invokes other smart contracts, including a first smart contract for providing redemption services between different types of digital resources.

In a specific embodiment, the business logic of the first smart contract includes: the first contract account receives a third amount of the first type of digital resources transferred from the first account and transfers a fourth amount of the second type of digital resources from the first contract account to the first account.

In one embodiment, the transfer party or the transfer party for each transfer event is the target account.

In one embodiment, the types of digital resources relate to a third type of digital resource; the resource value determination module 340 includes: an exchange rate determining unit 341 configured to determine an exchange rate between a third type of digital resource and a fourth type of digital resource, the fourth type of digital resource having a preset value; the value determining unit 342 is configured to determine a resource value of the third type of digital resource according to the exchange rate and the preset value.

In a specific embodiment, exchange rate determination unit 341 is specifically configured to: determining the resource quantity of the third type of digital resources and the fourth type of digital resources in the corresponding resource pools according to the updating events of the digital resource quantity which occur in the target transaction and before the target transaction, wherein the updating events are obtained by analyzing transaction data of a plurality of transactions stored in a blockchain; substituting the number of the resources into a preset exchange rate calculation formula for the third type of digital resources and the fourth type of digital resources, and solving the exchange rate.

In one embodiment, the resource value determination module 340 is specifically configured to: and taking the preset value of the fourth type of digital resources as the resource value of the fourth type of digital resources.

In one embodiment, the target transaction involves several classes of digital resources, the target account having an initial digital resource prior to execution of the target transaction; the value change determination module 350 is specifically configured to: determining a type intersection between the initial digital resource and the digital resources of the plurality of classes; determining initial values of each type in the type intersection before the target transaction is executed; the value change is determined based on the number of resources, the amount of resource change, the initial value, and the value of the resources corresponding to each type in the initial data resources.

In one embodiment, the party to or from each transfer event is one of the target account and the initiating account for the target transaction; the resource change determination module 330 is specifically configured to: determining the resource variation quantity of a target account and an initiating account for various digital resources together; the value change determination module 350 is specifically configured to: and determining the target transaction as a value change amount generated by the target account and the initiating account together.

In a specific embodiment, the apparatus 300 further comprises: a risk determination module 360 configured to determine whether the value change is greater than a preset delta threshold; and if the target transaction is judged to be greater than the risk transaction, judging the target transaction to be the risk transaction.

The present description also provides a computer-readable storage medium having stored thereon a computer program which, when executed in a computer, causes the computer to perform the method as shown in fig. 2.

Embodiments of the present disclosure also provide a computing device including a memory having executable code stored therein and a processor that, when executing the executable code, implements the method shown in fig. 2.

In the 90 s of the 20 th century, improvements to one technology could clearly be distinguished as improvements in hardware (e.g., improvements to circuit structures such as diodes, transistors, switches, etc.) or software (improvements to the process flow). However, with the development of technology, many improvements of the current method flows can be regarded as direct improvements of hardware circuit structures. Designers almost always obtain corresponding hardware circuit structures by programming improved method flows into hardware circuits. Therefore, an improvement of a method flow cannot be said to be realized by a hardware entity module. For example, a programmable logic device (Programmable Logic Device, PLD) (e.g., field programmable gate array (Field Programmable Gate Array, FPGA)) is an integrated circuit whose logic function is determined by the programming of the device by a user. A designer programs to "integrate" a digital system onto a PLD without requiring the chip manufacturer to design and fabricate application-specific integrated circuit chips. Moreover, nowadays, instead of manually manufacturing integrated circuit chips, such programming is mostly implemented by using "logic compiler" software, which is similar to the software compiler used in program development and writing, and the original code before the compiling is also written in a specific programming language, which is called hardware description language (Hardware Description Language, HDL), but not just one of the hdds, but a plurality of kinds, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), lava, lola, myHDL, PALASM, RHDL (Ruby Hardware Description Language), etc., VHDL (Very-High-Speed Integrated Circuit Hardware Description Language) and Verilog are currently most commonly used. It will also be apparent to those skilled in the art that a hardware circuit implementing the logic method flow can be readily obtained by merely slightly programming the method flow into an integrated circuit using several of the hardware description languages described above.

The controller may be implemented in any suitable manner, for example, the controller may take the form of, for example, a microprocessor or processor and a computer readable medium storing computer readable program code (e.g., software or firmware) executable by the (micro) processor, logic gates, switches, application specific integrated circuits (Application Specific Integrated Circuit, ASIC), programmable logic controllers, and embedded microcontrollers, examples of which include, but are not limited to, the following microcontrollers: ARC 625D, atmel AT91SAM, microchip PIC18F26K20, and Silicone Labs C8051F320, the memory controller may also be implemented as part of the control logic of the memory. Those skilled in the art will also appreciate that, in addition to implementing the controller in a pure computer readable program code, it is well possible to implement the same functionality by logically programming the method steps such that the controller is in the form of logic gates, switches, application specific integrated circuits, programmable logic controllers, embedded microcontrollers, etc. Such a controller may thus be regarded as a kind of hardware component, and means for performing various functions included therein may also be regarded as structures within the hardware component. Or even means for achieving the various functions may be regarded as either software modules implementing the methods or structures within hardware components.

The system, apparatus, module or unit set forth in the above embodiments may be implemented in particular by a computer chip or entity, or by a product having a certain function. One typical implementation device is a server system. Of course, the present application does not exclude that as future computer technology evolves, the computer implementing the functions of the above-described embodiments may be, for example, a personal computer, a laptop computer, a car-mounted human-computer interaction device, a cellular telephone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

Although one or more embodiments of the present description provide method operational steps as described in the embodiments or flowcharts, more or fewer operational steps may be included based on conventional or non-inventive means. The order of steps recited in the embodiments is merely one way of performing the order of steps and does not represent a unique order of execution. When implemented in an actual device or end product, the instructions may be executed sequentially or in parallel (e.g., in a parallel processor or multi-threaded processing environment, or even in a distributed data processing environment) as illustrated by the embodiments or by the figures. The terms "comprises," "comprising," or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but may include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without further limitation, it is not excluded that additional identical or equivalent elements may be present in a process, method, article, or apparatus that comprises a described element. For example, if first, second, etc. words are used to indicate a name, but not any particular order.

For convenience of description, the above devices are described as being functionally divided into various modules, respectively. Of course, when one or more of the present description is implemented, the functions of each module may be implemented in the same piece or pieces of software and/or hardware, or a module that implements the same function may be implemented by a plurality of sub-modules or a combination of sub-units, or the like. The above-described apparatus embodiments are merely illustrative, for example, the division of the units is merely a logical function division, and there may be additional divisions when actually implemented, for example, multiple units or components may be combined or integrated into another system, or some features may be omitted or not performed. Alternatively, the coupling or direct coupling or communication connection shown or discussed with each other may be an indirect coupling or communication connection via some interfaces, devices or units, which may be in electrical, mechanical or other form.

The present invention is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems) and computer program products according to embodiments of the invention. It will be understood that each flow and/or block of the flowchart illustrations and/or block diagrams, and combinations of flows and/or blocks in the flowchart illustrations and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.

These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instruction means which implement the function specified in the flowchart flow or flows and/or block diagram block or blocks.

These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.

In one typical configuration, a computing device includes one or more processors (CPUs), input/output interfaces, network interfaces, and memory.

The memory may include volatile memory in a computer-readable medium, random Access Memory (RAM) and/or nonvolatile memory, such as Read Only Memory (ROM) or flash memory (flash RAM). Memory is an example of computer-readable media.

Computer readable media, including both non-transitory and non-transitory, removable and non-removable media, may implement information storage by any method or technology. The information may be computer readable instructions, data structures, modules of a program, or other data. Examples of storage media for a computer include, but are not limited to, phase change memory (PRAM), static Random Access Memory (SRAM), dynamic Random Access Memory (DRAM), other types of Random Access Memory (RAM), read Only Memory (ROM), electrically Erasable Programmable Read Only Memory (EEPROM), flash memory or other memory technology, read only compact disc read only memory (CD-ROM), digital Versatile Discs (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage, graphene storage or other magnetic storage devices, or any other non-transmission medium, which can be used to store information that can be accessed by a computing device. Computer-readable media, as defined herein, does not include transitory computer-readable media (transmission media), such as modulated data signals and carrier waves.

One skilled in the relevant art will recognize that one or more embodiments of the present description may be provided as a method, system, or computer program product. Accordingly, one or more embodiments of the present description may take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Moreover, one or more embodiments of the present description can take the form of a computer program product on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) having computer-usable program code embodied therein.

One or more embodiments of the specification may be described in the general context of computer-executable instructions, such as program modules, being executed by a computer. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform particular tasks or implement particular abstract data types. One or more embodiments of the present specification may also be practiced in distributed computing environments where tasks are performed by remote processing devices that are linked through a communications network.

In a distributed computing environment, program modules may be located in both local and remote computer storage media including memory storage devices.

In this specification, all embodiments are described in a progressive manner, and all the same and similar parts of the embodiments are referred to each other by 0, and each embodiment mainly describes differences from other embodiments. In particular for system embodiments

In other words, since it is substantially similar to the method embodiments, the description is relatively simple, and reference is made to the description of the method embodiments for relevant points. In the description of the present specification, reference is made to the terms "one embodiment," "some embodiments," "examples," and "examples" and "embodiments" as used herein,

The description of "a particular example," or "some examples," etc., means that a particular feature, structure, material, or characteristic described in connection with the embodiment or example is included in at least one embodiment or example of the present description. In this specification, the 5-th-meaning expression of the above-mentioned terms is not necessarily for the same embodiment or example. Furthermore, the particular features, structures, materials, or characteristics of the description

The dots may be combined in any one or more embodiments or examples in a suitable manner. Furthermore, the different embodiments or examples described in this specification and the features of the different embodiments or examples may be combined and combined by those skilled in the art without contradiction.

The foregoing description is only one or more embodiments of the present specification and is not intended to limit one or more embodiments of the present specification. Various modifications and alterations to one or more embodiments of this specification will be apparent to those skilled in the art

And (5) melting. Any modification, equivalent replacement, improvement, or the like, which is within the spirit and principles of the present specification, should be included in the scope of the claims.

Claims

1. A method of detection for blockchain transactions, comprising:

Acquiring transaction data of a target transaction on a blockchain, wherein the target transaction invokes a target intelligent contract; the business logic of the target intelligent contract comprises: issuing the target class digital resources with the first quantity transferred from the contract account to the target account, and returning the target class digital resources with the second quantity transferred from the target account to the contract account;

resolving a plurality of transfer events from the transaction data, wherein each transfer event comprises a transfer party, a digital resource type, and the number of transfers occurring for the type of digital resource;

determining the resource variation of the target account for various digital resources according to the plurality of transfer events;

acquiring the resource value of the various digital resources when the target transaction execution is completed;

and determining the value change amount generated by the target transaction for the target account based on the resource change amount and the resource value, and judging the risk of the target transaction.

2. The method of claim 1, wherein the transaction data comprises at least one of: the transaction log comprises a transaction body and a transaction log, wherein the transaction log comprises the transfer events.

3. The method of claim 1, wherein obtaining transaction data for a target transaction on a blockchain includes:

acquiring transaction data of a plurality of transactions stored in a blockchain;

screening out a plurality of transactions calling a preset objective function based on transaction data of the transactions; the objective function is used for realizing the business logic;

and respectively taking each transaction in the plurality of transactions as the target transaction.

4. A method according to claim 3, wherein screening out a number of transactions that call a pre-set objective function based on transaction data of the plurality of transactions comprises:

removing transactions, in which the number of transfer events involved in the transaction data is less than a preset number threshold, from the plurality of transactions;

the number of transactions is screened from the remaining transactions based on transaction data of the remaining transactions.

5. The method of claim 1, wherein the target transaction also invokes other ones of the smart contracts, wherein the first smart contract included is to provide redemption services between different types of digital resources.

6. The method of claim 5, wherein the business logic of the first smart contract comprises: the first contract account receives a third amount of the first type of digital resources transferred from the first account and transfers a fourth amount of the second type of digital resources from the first contract account to the first account.

7. The method of claim 1, wherein the party to or from whom each transfer event is transferred is the target account.

8. The method of claim 1, wherein the types of digital resources relate to a third type of digital resource; the method for obtaining the resource value of the various digital resources when the target transaction execution is completed comprises the following steps:

determining exchange rate between the third type of digital resource and a fourth type of digital resource, wherein the fourth type of digital resource has preset value;

and determining the resource value of the third type of digital resource according to the exchange rate and the preset value.

9. The method of claim 8, wherein determining an exchange rate between the third and fourth types of digital resources comprises:

determining the resource quantity of each of the third type of digital resources and the fourth type of digital resources in a corresponding resource pool according to an update event of the digital resource quantity occurring in the target transaction and before the target transaction, wherein the update event is obtained by analyzing transaction data of a plurality of transactions stored in a blockchain;

substituting the number of the resources into an exchange rate calculation formula preset for the third type of digital resources and the fourth type of digital resources, and solving the exchange rate.

10. The method of claim 1, wherein the types of digital resources relate to a fourth type of digital resource; the method for obtaining the resource value of the various digital resources when the target transaction execution is completed comprises the following steps:

and taking the preset value of the fourth type of digital resource as the resource value of the fourth type of digital resource.

11. The method of claim 1, wherein the target transaction involves several classes of digital resources, the target account having an initial digital resource prior to execution of the target transaction; wherein determining the value change generated by the target transaction for the target account based on the resource change and the resource value comprises:

determining a type intersection between the initial digital resource and the several types of digital resources;

determining, for each type in the type intersection, its initial value prior to execution of the target transaction;

and determining the value change amount based on the resource quantity, the resource change amount, the initial value and the resource value corresponding to each type in the initial data resource.

12. The method of claim 1, wherein the party to or the party from each transfer event is one of the target account and an initiating account for the target transaction; the determining the resource variation of the target account for various digital resources comprises the following steps:

Determining the resource variation of the target account and the initiating account for the various digital resources together;

wherein determining the amount of change in value generated by the target transaction for the target account comprises:

and determining the target transaction as a value change amount generated by the target account and the initiating account together.

13. The method of any of claims 1-12, wherein, after determining the amount of value change generated by the target transaction for the target account, the method further comprises:

judging whether the value variation is larger than a preset increment threshold;

and if the target transaction is judged to be greater than the risk transaction, judging that the target transaction is a risk transaction.

14. A detection apparatus for blockchain transactions, comprising:

the transaction data acquisition module is configured to acquire transaction data of a target transaction on the blockchain, wherein the target transaction invokes a target intelligent contract; the business logic of the target intelligent contract comprises: issuing the target class digital resources with the first quantity transferred from the contract account to the target account, and returning the target class digital resources with the second quantity transferred from the target account to the contract account;

the transfer event determining module is configured to parse a plurality of transfer events from the transaction data, wherein each transfer event comprises a transfer party, a digital resource type and the quantity of transfer occurring for the digital resource type;

The resource change determining module is configured to determine the resource change amount of the target account aiming at various digital resources according to the plurality of transfer events;

the resource value determining module is configured to acquire the resource values of the various digital resources when the target transaction execution is completed;

and the value change determining module is configured to determine the value change amount generated by the target transaction for the target account based on the resource change amount and the resource value, and is used for judging the risk of the target transaction.

15. A computer readable storage medium having stored thereon a computer program which, when executed in a computer, causes the computer to perform the method of any of claims 1-13.

16. A blockchain node comprising a memory having executable code stored therein and a processor that, when executing the executable code, implements the method of any of claims 1-13.